v1.0.0-rc.28

⚠️ IMPORTANT WARNING / 重要警告 ⚠️

自 v1.0.0-rc.27 起引入的实验性插件系统仍处于测试阶段，并涉及较大的架构调整。如遇问题，请及时反馈。从 v1.0.0-rc.26 或更早版本升级的用户，必须重新配置所有视频模型价格；已在 v1.0.0-rc.27 完成配置的用户无需重复操作。不推荐在生产环境中使用本版本。

The experimental plugin system introduced in v1.0.0-rc.27 remains under testing and includes major architectural changes. Please report any issues promptly. Users upgrading from v1.0.0-rc.26 or earlier must reconfigure all video model prices; users who already completed this step on v1.0.0-rc.27 do not need to repeat it. This release is not recommended for production use.

New Features

• Added optional RSA-OAEP encryption for password-login request bodies. Enable it with PASSWORD_LOGIN_ENCRYPTION_ENABLED=true; this is an additional safeguard and does not replace HTTPS (#6743).
• Added AQBot to the default list of third-party chat options (#7079).
• Added support for channel model-mapping aliases and model-name case variants in task-plugin routing, including consistent upstream mapping and billing resolution.

Improvements

• Built-in task plugins now update with new-api releases; Marketplace actions no longer create unintended persistent overrides.
• Improved concurrent-write reliability for the default SQLite configuration by enabling WAL, a 30-second busy timeout, and immediate transactions (#7030).
• Improved PostgreSQL transaction-pooler compatibility by disabling prepared statements, and fixed JSON-column handling under the simple protocol.

Bug Fixes

• Prevented unbounded memory retention and potential OOM when an upstream does not return response headers (#6949). RELAY_RESPONSE_HEADER_TIMEOUT now defaults to 1800 seconds; set it to 0 to restore the previous unbounded behavior. Streaming after response headers arrive is unaffected.
• Fixed the frontend display of the "subscription-only" preference when no valid subscription exists (#7086).
• Fixed setup-status detection after a page reload (#6968).
• Changed relay request-validation failures to return HTTP 400 (#6774).
• Fixed Ali image models to honor the requested response format (#7048).

---

What's Changed

• fix(relay): 请求参数校验错误返回 HTTP 400 by @ax2 in #6774
• fix(web): recheck setup status after page reload by @seefs001 in #6968
• feat(chat): 将 AQBot 加入第三方聊天默认列表 by @Licoy in #7079
• fix(ali): honor image response format (#5513) by @PuppetKL in #7048
• fix(subscription): 无有效订阅时前端如实显示「仅用订阅」偏好 (#6222) by @CR-Yun in #7086
• fix(sqlite): enable WAL + working busy timeout + _txlock=immediate to stop concurrent write lockouts by @LinineTy in #7030
• fix(relay): bound the wait for upstream response headers (fixes unbounded heap growth → OOM) by @txgo in #6949

New Contributors

• @ax2 made their first contribution in #6774
• @PuppetKL made their first contribution in #7048
• @CR-Yun made their first contribution in #7086
• @LinineTy made their first contribution in #7030
• @txgo made their first contribution in #6949

Full Changelog: v1.0.0-rc.27...v1.0.0-rc.28